Month or two my Mac OS machine in ~5% cases goes aviasales.ru instead of imgur.com links that I click. The history in newly opened tab has only the current Aviasales URL, and the link I click looks fine and goes to Imgur, when I click again. I turned off all unreliable Chrome /extensions and see no new /plugins. Greping the extensions directory also didn't show me anything about "avia".
The only thread I've found on this is https://forums.malwarebytes.org/index.php?/topic/161783-home-network-hijacked-popupredirect-on-multiple-devices/page-2 where malware was probably in the router. I've checked settings -- DNS is set to default, so if it's in router, it odes not show up so easily. And my neighbour, using the same network via Windows 7, says he doesn't have my issue.
So the next thing I want to try to find the buster is to track hosts, that my browser accesses -- maybe it will show up at the moment before going the Aviasales website. How do I do it? Tcpdump? I want to get the list looking somehow like:
[timestamp]: IP [timestamp]: IP [timestamp]: IP